CVE-2026-54619: sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity
Using Database#create_function or Database#define_function to define the same function name more than once with different numbers of arguments (“arity”) or text encodings will result in a invalid memory read and a segmentation fault.
References
- github.com/advisories/GHSA-28hh-pr2h-2w89
- github.com/rubysec/ruby-advisory-db/blob/master/gems/sqlite3/CVE-2026-54619.yml
- github.com/sparklemotion/sqlite3-ruby/commit/2bd436d17f77cdd4c31b00fe9d50b0d21cbaf033
- github.com/sparklemotion/sqlite3-ruby/pull/710
- github.com/sparklemotion/sqlite3-ruby/releases/tag/v2.9.5
- github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-28hh-pr2h-2w89
- nvd.nist.gov/vuln/detail/CVE-2026-54619
- www.cve.org/CVERecord/SearchResults?query=CVE-2026-54619
Code Behaviors & Features
Detect and mitigate CVE-2026-54619 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →